SV-281213r1166591: RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file. | Red Hat Enterprise Linux 10 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file.

Description

Discussion Text

If the pam_faillock.so module is not loaded, the system will not correctly lock out accounts to prevent password guessing attacks.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000044

References

DPMS Target Red Hat Enterprise Linux 10 DISA DPMS Target Red Hat Enterprise Linux 10 5733

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel10os:def:281213
# RHEL 10 must configure the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# The pam_faillock.so module is present in password-auth before pam_unix.so
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^[\s]*auth[\s]+.*pam_faillock\.so.*preauth[^\n]*\n([\s\S]*)^[\s]*auth[\s]+.*pam_unix\.so' '/etc/pam.d/password-auth' &>/dev/null
}
# The pam_faillock.s module is included in password-auth and configured to preauth
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^[ \t]*auth[ \t]+required[ \t]+pam_faillock\.so[^#\n]*\b(\w+)\b/\1/p' '/etc/pam.d/password-auth') | grep -Pq '^preauth(\s|$)'
}
# The pam_faillock.s module is included in password-auth and configured for authfail
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  (sed -En 's/^[ \t]*auth[ \t]+required[ \t]+pam_faillock\.so[^#\n]*\b(\w+)\b/\1/p' '/etc/pam.d/password-auth') | grep -Pq '^authfail(\s|$)'
}
# The pam_faillock.so module is present in password-auth configured to be required for accounts
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  grep -Pq '^[ \t]*account[ \t]+required[ \t]+pam_faillock\.so' '/etc/pam.d/password-auth' &>/dev/null
}

if ( test_1 && test_2 && test_3 && test_4 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel10os:def:281213
if [ ! -f "/etc/pam.d/password-auth" ]; then echo "PASS"; exit 0; fi
if [ "$(grep -c "^[\\s]*auth[\\s]+.*pam_faillock\\.so.*preauth[^\\n]*\\n" /etc/pam.d/password-auth)" -ge "1" ] && \
[ "$(grep -c "^[ \\t]*auth[ \\t]+required[ \\t]+pam_faillock\\.so[^#\\n]*\\bauthfail\\b" /etc/pam.d/password-auth)" -ge "1" ] && \
[ "$(grep -c "^[ \\t]*account[ \\t]+required[ \\t]+pam_faillock\\.so" /etc/pam.d/password-auth)" -ge "1" ]; then echo "PASS"; exit 0; fi
echo "FAIL"; exit 1

Remediation

Configure RHEL 10 to include the use of the pam_faillock.so module in the "/etc/pam.d/password-auth" file. If PAM is managed with "authselect", enable the feature with the following command:

$ sudo authselect enable-feature with-faillock

Otherwise, add/modify the appropriate sections of the "/etc/pam.d/password-auth" file to match the following lines:

Note: The "preauth" line must be listed before pam_unix.so.

auth required pam_faillock.so preauth
auth required pam_faillock.so authfail
account required pam_faillock.so